fix(buds): tighten BUD-NNN matcher + guard relink to title-only edits

Code review of the post-merge fixes flagged two real regressions and
one auto-transition risk:

* The relaxed regex ``(?<![A-Za-z])(?<![A-Za-z]-)`` accepted
  ``1bud-3``, ``sha7bud-5``, ``v2bud-5``, and ``auth1-bud-7`` —
  digit-glued mid-word and prefix-with-trailing-digit shapes that
  are not real BUD references. Revert to the strict
  ``(?<![A-Za-z0-9-])`` prefix that uniformly rejects letters,
  digits, and hyphens on the left. Multi-BUD release branches are
  now handled by a SEPARATE chain matcher: ``extract_all_bud_numbers``
  finds each strict ``bud-NNN`` match and then walks forward through
  any ``-bud-NNN-bud-NNN`` tail. Six new parametrize-reject cases
  pin the digit-glued and trailing-digit-prefix rejections.

* ``_handle_pr_edited`` previously called ``resolve_bud_from_pr`` on
  every invocation. Now that the dispatcher also fires on base edits,
  unconditional re-resolution risked unlinking a PR whose title
  carried a once-accepted-now-rejected reference (the regex tightening
  is exactly that kind of contract change). Gate the relink to actual
  title changes; base / head edits still sync ``pr.base_branch`` and
  ``pr.head_branch`` but do not touch ``pr.bud_id``.

Auto-transition audit confirmed clean:
* ``check_all_repos_have_prs`` / ``check_all_prs_merged`` key off
  ``pr.bud_id``, not the text content — the matcher tightening only
  affects NEW PR-open / title-edit links, not existing rows.
* The development → code_review threshold is unaffected by base
  edits because the gate above blocks the only path that could have
  unlinked an existing link on a base-only edit.

Full backend suite green: 1887 passed.

Signed-off-by: Arun Rajkumar <mickyarunr@gmail.com>

Author: mickyarun

backend/app/api/v1/bud_prs.py

@@ -245,9 +245,7 @@ async def get_bud_release_stage(
         # and BUD-004 tabs, while an unrelated PR to ``main`` does not
         # leak through. Directly-linked PRs (``bud_id == bud_id``)
         # short-circuit so the user-edited link wins over text matching.
-        if pr.bud_id != bud_id and not pr_references_bud(
-            bud.bud_number, pr.head_branch, pr.title
-        ):
+        if pr.bud_id != bud_id and not pr_references_bud(bud.bud_number, pr.head_branch, pr.title):
             continue
         seen_pr_ids.add(pr.github_pr_id)
         open_prs.append(

backend/app/services/github_webhook_handler.py

@@ -443,10 +443,25 @@ async def _handle_pr_edited(
     if pr is None:
         return
 
+    # Title / base / head are always synced — the dispatcher only fires
+    # this handler when at least one of them changed, so the writes are
+    # never wasted.
+    title_changed = pr.title != pr_data.title
     pr.title = pr_data.title
     pr.base_branch = pr_data.base.ref
     pr.head_branch = pr_data.head.ref
 
+    # Only re-resolve the BUD link when the title actually changed. A
+    # base-only edit (the BUD-004 / PR-1997 case) must NOT trigger a
+    # re-resolution that could unlink a PR whose old title once carried
+    # a now-rejected reference shape (``auth1-bud-7``-style strings the
+    # previous, looser regex used to accept). The auto-transition checks
+    # downstream key off ``pr.bud_id``; leaving the link intact keeps
+    # the development → code_review threshold stable across base edits.
+    if not title_changed:
+        await db.commit()
+        return
+
     new_bud_id, new_bud = await resolve_bud_from_pr(db, org_id, pr_data.head.ref, pr_data.title)
     if new_bud_id == pr.bud_id:
         await db.commit()

backend/app/services/pr_auto_transition.py

@@ -36,36 +36,41 @@
 
 logger = structlog.get_logger(__name__)
 
-# Match ``bud-NNN`` anywhere in a string. Two stacked negative
-# lookbehinds reject the mid-word cases while keeping multi-BUD release
-# branches matchable:
+# Strict ``bud-NNN`` matcher. The negative lookbehind rejects every
+# letter, digit, or hyphen immediately before ``bud``, which covers all
+# the mid-word and run-on cases with one rule:
 #
-#   ``(?<![A-Za-z])``    — char before ``bud`` is not a letter
-#                          (rejects ``abcbud-5``, ``prebud-2``).
-#   ``(?<![A-Za-z]-)``   — char before ``bud`` is not "letter then -"
-#                          (rejects ``auth-bud-7``, ``token-bud-3``).
+#   ``auth-bud-7``  — rejected (``-`` before).
+#   ``abcbud-5``    — rejected (``c`` before).
+#   ``1bud-3``      — rejected (``1`` before).
+#   ``sha7bud-5``   — rejected (``7`` before).
+#   ``v2-bud-5``    — rejected (``-`` before; the leading digit doesn't
+#                    rescue it because ``-`` is in the rejection class).
+#   ``bud2name``    — rejected (no ``\b`` between digit and following
+#                    word char, trailing boundary fails).
 #
-# A leading hyphen preceded by a digit IS allowed, so multi-BUD release
-# branches surface every BUD they reference:
-#
-#   ``bud-008``, ``BUD-8``, ``bud8`` (case-insensitive, optional dash,
-#   leading zeros stripped) — accepted.
+#   ``bud-008``, ``BUD-8``, ``bud8`` — accepted.
 #   ``feat/BUD-7-rename``, ``[BUD-12]``, ``(bud-77)``, ``BUD-8 fix x``,
 #   ``Closes #BUD-4``, ``fix,BUD-3``, ``.BUD-2`` — accepted.
-#   ``release/bud-001-bud-004-bud-007`` — accepted (all three) because
-#   the digit-then-hyphen prefix bypasses both lookbehinds.
-#   ``auth-bud-7`` — rejected (``h-`` matches lookbehind 2).
-#   ``abcbud-5``  — rejected (``c`` matches lookbehind 1).
-#   ``bud2name``  — rejected (no ``\b`` between digit and following
-#                   word char, so the trailing boundary fails).
 #
-# Used to drive PR → BUD linking (both head branch and PR title), the
-# multi-BUD content guard in the release-stage tabs, and the Claude-Code
-# dev-activity hook below.
-_BUD_RE = re.compile(
-    r"(?<![A-Za-z])(?<![A-Za-z]-)bud-?0*(\d+)\b",
-    re.IGNORECASE,
-)
+# Multi-BUD release branches like ``release/bud-001-bud-004-bud-007``
+# only have one strict match (the first ``bud-001``); the rest are
+# discovered as a CHAIN appended to that first match — see
+# ``_BUD_CHAIN_RE`` and ``extract_all_bud_numbers`` below.
+#
+# Used to drive PR → BUD linking (head branch and title) and the
+# Claude-Code dev-activity hook.
+_BUD_RE = re.compile(r"(?<![A-Za-z0-9-])bud-?0*(\d+)\b", re.IGNORECASE)
+
+
+# Anchored variant for chain extraction. After a strict ``bud-NNN``
+# match, any number of trailing ``-bud-NNN`` segments belong to the
+# same chain (multi-BUD release branch). The chain regex is anchored
+# to start-of-string because it is applied to the captured chain tail,
+# not the full input; ``finditer`` then walks each ``bud-NNN`` token
+# inside that tail.
+_BUD_CHAIN_TAIL_RE = re.compile(r"(?:-bud-?0*\d+\b)+", re.IGNORECASE)
+_BUD_IN_CHAIN_RE = re.compile(r"bud-?0*(\d+)\b", re.IGNORECASE)
 
 
 def extract_bud_number(text: str | None) -> int | None:
@@ -86,11 +91,29 @@ def extract_all_bud_numbers(text: str | None) -> set[int]:
     Release branches like ``release/bud-001-bud-004-bud-007`` carry
     several BUDs at once; the release-stage tabs need to know all of
     them so the same PR shows up on each BUD's tab when it genuinely
-    relates to that BUD. Returns an empty set on falsy / no-match input.
+    relates to that BUD. Two passes:
+
+    1. Strict regex finds every ``bud-NNN`` token that is not glued to
+       a letter / digit / hyphen on the left.
+    2. For each match, look at the immediately-following text for a
+       ``-bud-NNN-bud-NNN...`` chain and add every BUD number in it.
+       The chain step intentionally allows the hyphen-prefix that
+       Pass 1 rejects — within a chain, the preceding ``-`` came from
+       the previous BUD reference, not from a leading word.
+
+    Returns an empty set on falsy / no-match input.
     """
     if not text:
         return set()
-    return {int(m.group(1)) for m in _BUD_RE.finditer(text)}
+    result: set[int] = set()
+    for match in _BUD_RE.finditer(text):
+        result.add(int(match.group(1)))
+        tail = _BUD_CHAIN_TAIL_RE.match(text, match.end())
+        if tail is None:
+            continue
+        for chain_match in _BUD_IN_CHAIN_RE.finditer(tail.group(0)):
+            result.add(int(chain_match.group(1)))
+    return result
 
 
 def pr_references_bud(

backend/tests/services/test_pr_auto_transition.py

@@ -74,6 +74,18 @@ def test_extract_bud_number_accepts_real_world_forms(text: str, expected: int) -
         # Glued to other digits.
         "bud2name",
         "abcbud-5",
+        # Run-on with a leading digit / sha-like prefix — the prior relaxed
+        # regex accepted these; the strict prefix now rejects them.
+        "1bud-3",
+        "sha7bud-5",
+        "v2bud-5",
+        # Hyphen-separated label with a trailing digit: ``a1-bud-7``-style
+        # patterns are NOT valid BUD chains (multi-BUD chains start with
+        # a fresh ``bud-NNN``, not a non-BUD token). Locked in so the
+        # next regex tweak doesn't widen here.
+        "auth1-bud-7",
+        "repo2-bud-3",
+        "team42-bud-9",
         # No number.
         "feature/bud-x",
         "release/uat",